Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
Status
Not open for further replies.

Admiral black

macrumors newbie
Original poster
Aug 20, 2023
15
2
I need help eradicating malware that seems to be attached to an iCloud or Apple ID. I’ve since abandoned those accounts but the malware remains. There is a second user named the same as me that has admin privileges which can be seen in terminal and the console. Symptoms include…

1) disk utility is unmounting the Data HD system volume
2) deescalating my admin privileges
3) changing network setting and locking me out of Ethernet and wifi
4) used 12,000g of internet data in 14days this month
5) forced firewall logging through terminal yet firewall logs are “being sent to an ASL sender”
6) with the firewall locked down upon boot up control center opens two outside connections (that may be normal but given the circumstances it makes me weary)
7) trying to install new Mac OS and it says it cannot authenticate (the actual verbiage I would have to try again and post)

Any help as I’m desperate to stop this and lastly Kaspersky has found a directory that has a keylogger but it’s locked and it cannot delete the volume/ directory. Thanks much in advance!!!
 
Last edited:

JonaM

macrumors regular
Sep 26, 2017
191
201
In the other post you made about this you were trying to change core system files like the sudoer file as you believed it had been tampered with.
Looking at the list of symptoms you’ve listed it may be possible that you’re seeing routine entries in console/logs and reading those as signs of malicious activity. (Eg network settings locking in control panel is normal behaviour)
 

Arctic Moose

macrumors 68000
Jun 22, 2017
1,599
2,133
Gothenburg, Sweden
Lots of terminology confusion here.

Do you have anything on the computer that you need (or want) to save, or is it safe to start fresh?

Can you log in to the iCloud accounts you believe are compromised at icloud.com?
 

JonaM

macrumors regular
Sep 26, 2017
191
201
For reference the OP has already wiped and reinstalled the machines from scratch before, but believes there is a persistent threat that is being reinstalled from a compromise in iCloud due to entries in terminal and logs.
 

Arctic Moose

macrumors 68000
Jun 22, 2017
1,599
2,133
Gothenburg, Sweden
For reference the OP has already wiped and reinstalled the machines from scratch before, but believes there is a persistent threat that is being reinstalled from a compromise in iCloud due to entries in terminal and logs.

There appears to be at least two Macs that are supposedly affected, and the statement about fresh installs may refer only to the (default) sudoers file persisting. I feel there is lots of room for increased clarity.

(Considering the amount of misunderstanding regarding various concepts, I’d like to see a USB install including formatting of all drives as a first step.)
 

Fishrrman

macrumors Penryn
Feb 20, 2009
29,239
13,310
Option 1:
Completely erase the drive and start over.
Perhaps you can salvage some personal information.
I would NOT use migration assistant in this case.

Option 2:
If option 1 doesn't work, disconnect computer and put it into the closet.
Buy a completely NEW Mac, and start fresh.

But... BEFORE YOU DO EITHER OF THE ABOVE...
... have you tried running MalwareBytes...?
 
  • Like
Reactions: HawkTheHusky1902

Admiral black

macrumors newbie
Original poster
Aug 20, 2023
15
2
There appears to be at least two Macs that are supposedly affected, and the statement about fresh installs may refer only to the (default) sudoers file persisting. I feel there is lots of room for increased clarity.

(Considering the amount of misunderstanding regarding various concepts, I’d like to see a USB install including formatting of all drives as a first step.)
I truly appreciate you sincere reply, can you provide the steps that you mention? Let me know and where to upload. Thanks much!
 

Arctic Moose

macrumors 68000
Jun 22, 2017
1,599
2,133
Gothenburg, Sweden
I truly appreciate you sincere reply, can you provide the steps that you mention? Let me know and where to upload. Thanks much!
First steps:

  • Can you log in to the accounts that you believe are compromised at icloud.com?

If yes:

  1. Go to https://appleid.apple.com/account/manage/section/devices and list ALL the devices that are listed here.
  2. Is two-factor on? Go to https://appleid.apple.com/account/manage/section/security and paste the result here. (If it is off, don't change it just yet, just paste the result.)
  3. On the same page, are there any trusted phone numbers? If yes, click that pane and check that any number listed is actually yours.
  4. Do you have any data at all on any of your Macs or iOS devices that you need (or want) to keep?
  5. Do you have any peripherals connected to your devices? List everything, hard drives, cameras, mice, keyboards, etc.
Start there, and we'll get to resetting your devices next. Please read the instructions carefully, and follow them in the order provided, and answer all the questions. Doing so will speed up your recovery.

Also, please do not ever publicly (or in private for that matter) post ANY personal identifiable information, such as phone numbers, e-mail addresses, iCloud user names, serial numbers or passwords.
 
Last edited:

Admiral black

macrumors newbie
Original poster
Aug 20, 2023
15
2
Again I appreciate the concern and your time and opinions as well as anyone else who may offer and advice. I’ll answer your question first and then offer what I can say with confidence as I’ve been a loyal Apple customer and client since the iPhone 4 but it’s become apparent Apple isn’t Apple anymore from the most secure to the least secure I’ll finish in just a moment….

Devices signed in and for 2fa I use hardware keys. FWIW the keys come in handy if one wants to lock an Apple ID and throw away the keys lol. As far as resetting I’ve done that on two occasions, the second time taking my entire ecosystem, which consist of MacBook Air M1, Mac mini M2, iPad mini 6 and iPhone 15 pro all at the same time. I Reset them all to factory from brand new devices no backups and issued a new Apple ID. However, the one thing that’s common to all three is I used the same phone number for the Apple ID, which is now been removed and replaced with a brand new phone number. I would like to think of myself as info. security minded I don’t have social Media accounts I’m not a member of talk forums other than here, I don’t have a public web presence but to the contrary, I do my best to clean up behind myself, and to maintain the smallest footprint I can when it comes to the Wild Wild West. I should mention my profession, a land developer, so if it weren’t for dirt I would’ve never had a job so technologies not my forte although I can find my way around an iPhone, and a MacBook fairly well and enjoy Apple products as they simplify and streamline my life however, it sure feels Apple is strayed away from what Steve Jobs had in mind to a sharing and fairing platform. What’s with all the sharing crap?! so here’s the punchline. I went out and bought a brand new MacBook M2 didn’t put an Apple ID in it didn’t put my thumbprint in it turned it on, and here’s the mistake I made tethered it to my iPhone 15 for a hotspot to activate the Mac within 20 minutes Through https:// port 443 I’m brute forced entered through .ssh, the system was overtaken in minutes. I couldn’t block all conveniently incoming connections fast enough and my hard drive was hijacked. Attached is disk utilities report which states com.apple.mobileso has reformatted the drive conveniently unmounted the system volume and loaded it full of malware. It’s a raging out of control assault machine that has my keychain, and every other photo and digital personal item I’ve ever had and I cannot stop it, I’m not fast enough in the terminal, nor at this point have any idea how to gain control of it. hindsight 2020 they have gained access through SSH and the console. I can see the malware matter of fact Stevie Wonder can see it. The entire system is nothing but malware that I cannot delete it as my admin privileges revoked nor does sudo or su commands have any output. A simple “sorry” is all she replies! I’ve attached photos that I had to email to a different account as the photos are being deleted, almost as fast as I can take them. My iCloud accounts I’m being logged in and out of for some reason being locked into now so whatever that means I don’t know, and the device passcode if you can believe has been turned on and off a few times as well as Face ID. The last time I logged into Apple, I had two passkeys saved. Double logins for my email and any other account that has logged and yes, that’s with two factor. I’d give my left one to see the photo of the other passkey as it would give me a visual as I hunt them like a polar bear!!! I recently read malware is up 200% with Apple devices so after reading this does anybody like to claim that iOS devices don’t have malware? Apologies if I’m coming across as short, but my patience has been tested. Like to finish with mentioning, I did purchase an additional MacBook M2 that’s in a box and if anybody knows how to completely disable ssh, and any other Telnet or remote access, I will pay good money to have that service provided.!
 

Attachments

  • IMG_0190.png
    IMG_0190.png
    231.9 KB · Views: 143
  • IMG_0177.jpeg
    IMG_0177.jpeg
    513.2 KB · Views: 152
  • IMG_0178.jpeg
    IMG_0178.jpeg
    428.6 KB · Views: 148
  • IMG_0172.jpeg
    IMG_0172.jpeg
    339.6 KB · Views: 132
  • IMG_0174.jpeg
    IMG_0174.jpeg
    394 KB · Views: 129
  • IMG_0189.png
    IMG_0189.png
    229.3 KB · Views: 144

richmlow

macrumors 6502
Jul 17, 2002
390
285
Again I appreciate the concern and your time and opinions as well as anyone else who may offer and advice. I’ll answer your question first and then offer what I can say with confidence as I’ve been a loyal Apple customer and client since the iPhone 4 but it’s become apparent Apple isn’t Apple anymore from the most secure to the least secure I’ll finish in just a moment….

Devices signed in and for 2fa I use hardware keys. FWIW the keys come in handy if one wants to lock an Apple ID and throw away the keys lol. As far as resetting I’ve done that on two occasions, the second time taking my entire ecosystem, which consist of MacBook Air M1, Mac mini M2, iPad mini 6 and iPhone 15 pro all at the same time. I Reset them all to factory from brand new devices no backups and issued a new Apple ID. However, the one thing that’s common to all three is I used the same phone number for the Apple ID, which is now been removed and replaced with a brand new phone number. I would like to think of myself as info. security minded I don’t have social Media accounts I’m not a member of talk forums other than here, I don’t have a public web presence but to the contrary, I do my best to clean up behind myself, and to maintain the smallest footprint I can when it comes to the Wild Wild West. I should mention my profession, a land developer, so if it weren’t for dirt I would’ve never had a job so technologies not my forte although I can find my way around an iPhone, and a MacBook fairly well and enjoy Apple products as they simplify and streamline my life however, it sure feels Apple is strayed away from what Steve Jobs had in mind to a sharing and fairing platform. What’s with all the sharing crap?! so here’s the punchline. I went out and bought a brand new MacBook M2 didn’t put an Apple ID in it didn’t put my thumbprint in it turned it on, and here’s the mistake I made tethered it to my iPhone 15 for a hotspot to activate the Mac within 20 minutes Through https:// port 443 I’m brute forced entered through .ssh, the system was overtaken in minutes. I couldn’t block all conveniently incoming connections fast enough and my hard drive was hijacked. Attached is disk utilities report which states com.apple.mobileso has reformatted the drive conveniently unmounted the system volume and loaded it full of malware. It’s a raging out of control assault machine that has my keychain, and every other photo and digital personal item I’ve ever had and I cannot stop it, I’m not fast enough in the terminal, nor at this point have any idea how to gain control of it. hindsight 2020 they have gained access through SSH and the console. I can see the malware matter of fact Stevie Wonder can see it. The entire system is nothing but malware that I cannot delete it as my admin privileges revoked nor does sudo or su commands have any output. A simple “sorry” is all she replies! I’ve attached photos that I had to email to a different account as the photos are being deleted, almost as fast as I can take them. My iCloud accounts I’m being logged in and out of for some reason being locked into now so whatever that means I don’t know, and the device passcode if you can believe has been turned on and off a few times as well as Face ID. The last time I logged into Apple, I had two passkeys saved. Double logins for my email and any other account that has logged and yes, that’s with two factor. I’d give my left one to see the photo of the other passkey as it would give me a visual as I hunt them like a polar bear!!! I recently read malware is up 200% with Apple devices so after reading this does anybody like to claim that iOS devices don’t have malware? Apologies if I’m coming across as short, but my patience has been tested. Like to finish with mentioning, I did purchase an additional MacBook M2 that’s in a box and if anybody knows how to completely disable ssh, and any other Telnet or remote access, I will pay good money to have that service provided.!

Hello Admiral black,


I have some practical advice for your problem.

1. Take your brand-new Macbook M2 and set it up, WITHOUT Apple ID / iCloud. Here is a Youtube link on how
to do this:


2. Do NOT tether this brand-new Macbook M2 to your cell-phone for Wi-Fi hotspot, etc.

3. Activate all security features on this brand-new Macbook M2 (firewall, etc.) which do not require Apple ID / iCloud.

4. When using this brand-new Macbook M2, use 2FA (whenever possible) for online accounts. Again, do NOT use Apple ID / icloud on this Macbook M2.

5. Keep this Macbook M2 "lock-downed." Do not download, open, etc. suspicious or unknown files.

6. This Macbook M2 is for mission-critical tasks.

7. For non-critical tasks, continue to use your "compromised / hacked" computer systems.


Good luck and let us know how things go.


Sincerely,
richmlow
 

Arctic Moose

macrumors 68000
Jun 22, 2017
1,599
2,133
Gothenburg, Sweden
Modern macOS doesn’t even come with telnet installed, and ssh is disabled by default. None of this makes any sense. What do you mean specifically by “blocking incoming connections”?

There is NOTHING in any of the pictures or logs you have posted so far that suggests ANYTHING out of the ordinary.

Could you post some actual evidence of compromise, software you have not installed yourself or unwanted activity? Please be very specific.
 
Last edited:

Admiral black

macrumors newbie
Original poster
Aug 20, 2023
15
2
Modern macOS doesn’t even come with telnet installed, and ssh is disabled by default. None of this makes any sense. What do you mean specifically by “blocking incoming connections”?

There is NOTHING in any of the pictures or logs you have posted so far that suggests ANYTHING out of the ordinary.

Could you post some actual evidence of compromise, software you have not installed yourself or unwanted activity? Please be very specific.
Can you see the hard drive reformatted by “mobile obliterator” and com.apple.mobileso? As well the system volumes have been unmounted and shared with 5 other volumes? As well mounted with a newer version that what was running I believe is what disk utility is stating. But to answer your question in specific when I say outside connection I mean for instance “avast” posed as *root asking for so many connections and so fast I couldn’t hit block Fast enough and one or two got through. Is my network compromised absolutely, could it be my lorex camera system, a smart bulb and they’ve been there for sometime mapping out my network and pounced now I don’t know I’m just speculating but it could be any number of the above but how can it come through my WiFi hot spot from my iPhone? I was using that because I felt it was the best choice given what I’m mentioning. ?
 
Last edited:

Arctic Moose

macrumors 68000
Jun 22, 2017
1,599
2,133
Gothenburg, Sweden
Can you see the hard drive reformatted by “mobile obliterator” and com.apple.mobileso?

I certainly can, and these are normal, just like your entirely default sudoers file.

Once again, please stop speculating, and post some pictures of the actual problems this “compromise” is causing. So far there is no sign of anything malicious at all.
 
Last edited:

Admiral black

macrumors newbie
Original poster
Aug 20, 2023
15
2
I certainly can, and these are normal, just like your enrirely default sudoers file.

Once again, please stop speculating, and post some pictures of the actual problems this “compromise” is causing. So far there is no sign of anything malicious at all.
I’m trying to understand your logic. I’ll reiterate brand new MacBook M2 has approximately 4-5 hours total time on it, has an unmounted McIntosh HD system volumes that I’ve remounted twice and now get an error as I do not have the permissions and is running a disk image of HD, and a touch on the pseudo file, nor sudo, nor sudo su have any output it’s reply “sorry” command not found, has been reformatted twice the second time disk utility warns with a newer version I believes is how it states in ( photo) and a warning, has racked up approximately 12,000 GB of internet data and I am Locked out of the system at around 10 PM at night until seven or 8 AM the next morning that’s normal… and I could keep going should I mention his disabled my firewall with IPV6 rules and my antivirus with Plist files, as well as my network connections have hardwired IP addresses that I cannot change. I do not concur. It’s not my normal. I will reckon that. If you have any working knowledge of the terminal environment, I will gladly give you the MacBook and five dollars to see what you can make of it.?
 
Last edited:

bearda

macrumors 6502a
Dec 2, 2005
507
176
Roanoke, VA
I’m trying to understand your logic. I’ll reiterate brand new MacBook M2 has approximately 4-5 hours total time on it, has an unmounted McIntosh HD system volumes that I’ve remounted twice and now get an error as I do not have the permissions and is running a disk image of HD, and a touch on the pseudo file, nor sudo, nor sudo su have any output it’s reply “sorry” command not found, has been reformatted twice the second time disk utility warns with a newer version I believes is how it states in ( photo) and a warning, has racked up approximately 12,000 GB of internet data and I am Locked out of the system at around 10 PM at night until seven or 8 AM the next morning that’s normal… and I could keep going should I mention his disabled my firewall with IPV6 rules and my antivirus with Plist files, as well as my network connections have hardwired IP addresses that I cannot change. I do not concur. It’s not my normal. I will reckon that. If you have any working knowledge of the terminal environment, I will gladly give you the MacBook and five dollars to see what you can make of it.?
I was under the impression the system volume behavior you were describing is normal on newer versions of MacOS. That's the exact same thing my system reports now, no hacking involved. The data volume get mounted read/write, but the system volume on / is a read-only snapshot.

Using 12 TB of Internet traffic is pretty interesting, though. With a wireless connection I'd dare say that's almost impossible given the raw bandwidth involved. How are you determining that?

As for the APFS version mismatches when you took the first screenshot had you updated to the latest version of MacOS yet? APFS version numbers change along with the MacOS version sometimes, so it's possible if you did a full wipe of the drive and went back to the original version of MacOS shipped with the machine the "newer version" of the APFS extension used to access the filesystem was from the newer version of MacOS used to wipe it out, and that that warning would appear until the newest update was installed (at which point they'd match). As for the process names those are all normal utilities that are part of MacOS, even mobile_obliterator.

No evidence of malware here in the info that you've showed so far.
 

Arctic Moose

macrumors 68000
Jun 22, 2017
1,599
2,133
Gothenburg, Sweden
I’m trying to understand your logic.

If you installed Avast it is obviously not a stock system.

Stop installing stuff.

Stop looking at logs.

Stop messing with system files.

Stop running diagnostics.

Stop posting cybersecurity word soup.

Just use your computer like a normal person, and take pictures of some actual malicious activity.

If you have any working knowledge of the terminal environment

I do.

I will gladly give you the MacBook and five dollars to see what you can make of it.?

I could remote into it, but it seems to me that letting random people into your Mac is sort of the opposite of what you want to achieve.

However, if you can post som actual evidence of anything malicious, I’d be happy to have a look.
 
Last edited by a moderator:

Admiral black

macrumors newbie
Original poster
Aug 20, 2023
15
2
If you installed Avast it is obviously not a stock system.

Stop installing stuff.

Stop looking at logs.

Stop messing with system files.

Stop running diagnostics.

Stop posting cybersecurity word soup.

Just use your computer like a normal person, and take pictures of some actual malicious activity.



I do.



I could remote into it, but it seems to me that letting random people into your Mac is sort of the opposite of what you want to achieve.

However, if you can post som actual evidence of anything malicious, I’d be happy to have a look.
Hi there here’s a start but in particular what your seeing can you’ll have to reference my original post i.e. the reformatting of my hard drive mind you a brand new laptop now two of them but this is my Mac hard drive running on my iPhone ie. diskutil list and /dev/disk2 is a preboot volume and an security update I believe but it’s running my phone. I’m having difficulty attaching more photos to this post, so let me know what else you’d like to see the routing table is quite interesting Lol and and while this isn’t directed at you directly, just a statement but when
You see and begin to actually absorb what many people have been complaining about over the last few years and while a security patch, almost every week is still not enough so instead of repeating and please excuse me because I don’t believe I’ve heard you utter these words, but as you know, they are the go to punchline and that is “apple/Mac can’t be infected with malware, erase and reset factory and you’ll be just fine” folks it’s 2023 and that entire premise is well might I say idiotic, and lacks any factual basis and is going to most likely be the downfall of a great company that once was because while everyone is professing with their nose, stuck in the air that apple/Mac can’t be infected with malware, there’s malware out there most likely sitting on their very own device, yet so elusive and sneaky they would never know so wake up get your head out of the clouds as it stands by the time you all finally decide to acknowledge the pink elephant in the room it’s gonna be too late! I digress But for lack of better words, I’m exhausted of this. This has been never ending constantly changing always evolving virus/malware/spyware/poison that I’ve been tracking down and it’s constantly moving from every device I own that’s ever been logged into an Apple ID. I’ve been a loyal customer of Apple since the iPhone 4. But today I say farewell, I bought myself a windows, PC and an android phone. What a long, strange trip it’s been!
 

Attachments

  • IMG_0013.png
    IMG_0013.png
    279.4 KB · Views: 91
  • IMG_0021.png
    IMG_0021.png
    245 KB · Views: 82
  • IMG_0018.png
    IMG_0018.png
    240.4 KB · Views: 78
  • IMG_0019.png
    IMG_0019.png
    268.7 KB · Views: 94
  • IMG_0020.png
    IMG_0020.png
    280.4 KB · Views: 89
  • Sad
Reactions: heretiq

Admiral black

macrumors newbie
Original poster
Aug 20, 2023
15
2
I am aware.

I was referencing this part:
I have to correct you .ssh or sshd is open to whatever port you want to point the service to. Yes default is 22 and secondly your remark referring to “that’s impossible” and stating ssh isn’t turned on by default is false and the verbage indicates you may not know what you’re speaking of? It is indeed “turned on” whenever the machine has a network connection. Can it be configured in a way that provides some security yes, but not when you first open the lid on a brand new device and with my experience now I’ll never direct a new machine at a network connection until that’s configured as tight as I can get it. Anyhow carry-on I’ve posted a few photos. Let me know if that’s the first Mac APFS hard drive mounted and running on an iPhone you’ve seen.
 

Admiral black

macrumors newbie
Original poster
Aug 20, 2023
15
2
I was under the impression the system volume behavior you were describing is normal on newer versions of MacOS. That's the exact same thing my system reports now, no hacking involved. The data volume get mounted read/write, but the system volume on / is a read-only snapshot.

Using 12 TB of Internet traffic is pretty interesting, though. With a wireless connection I'd dare say that's almost impossible given the raw bandwidth involved. How are you determining that?

As for the APFS version mismatches when you took the first screenshot had you updated to the latest version of MacOS yet? APFS version numbers change along with the MacOS version sometimes, so it's possible if you did a full wipe of the drive and went back to the original version of MacOS shipped with the machine the "newer version" of the APFS extension used to access the filesystem was from the newer version of MacOS used to wipe it out, and that that warning would appear until the newest update was installed (at which point they'd match). As for the process names those are all normal utilities that are part of MacOS, even mobile_obliterator.

No evidence of malware here in the info that you've showed so far.
Of Mac OS or Apple iOS?
 
Status
Not open for further replies.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.